Authorization Bypass in wpForo Forum Plugin for WordPress

CVE-2026-91092

What is CVE-2026-91092?

The wpForo Forum plugin for WordPress exposes an authorization bypass vulnerability that affects all versions up to 3.1.5. This flaw allows authenticated users, with subscriber-level access or higher, to manipulate guest authors' forum posts. By failing to properly verify user permissions, attackers can take over another author's post, altering critical attributes such as the title, body content, author name, and stored email address. This exploitation necessitates that guest posting and editing features are active within the forum framework, as well as knowledge of the target guest author's email address. Website administrators are encouraged to update to the latest plugin version to mitigate this issue.

References